How to Create a Risk Register in Notion
Every product project carries risks — technical unknowns, dependency delays, scope changes, resource constraints, and market shifts. A risk register makes these risks visible and manageable instead of letting them lurk as unspoken anxieties. When risks are documented with mitigation plans, they become manageable problems rather than surprise crises.
Notion's database features make it straightforward to build a risk register that's more than a static spreadsheet. With status tracking, automated risk scores, filtered views, and collaborative updates, your risk register becomes a living tool that evolves with the project. This guide shows you how to build one that your team will actually maintain and use.
Step-by-step guide
Create the Risk Register Database
Create a Notion database called 'Risk Register' with these core properties: Risk Title (title), Description (text — what could go wrong and why), Category (select: Technical, Resource, Scope, External, Schedule, Regulatory), Probability (select: Low 1, Medium 2, High 3, Very High 4), Impact (select: Low 1, Medium 2, High 3, Very High 4), Risk Score (formula: probability * impact), Status (select: Identified, Mitigating, Accepted, Resolved, Occurred), Owner (person), and Project (relation to projects database).
- Add a 'Mitigation Plan' rich text property for the detailed response strategy
- Create a 'Trigger Indicators' text property describing the early warning signs that the risk is materializing
- Add a 'Last Reviewed' date property to track when each risk was last assessed
Define Risk Categories and Scoring
Document the definitions for each probability and impact level so scoring is consistent across the team. Probability: Low (unlikely, less than 20%), Medium (possible, 20-50%), High (likely, 50-80%), Very High (almost certain, above 80%). Impact: Low (minor delay or workaround), Medium (significant delay or feature reduction), High (major scope cut or deadline miss), Very High (project failure or critical business impact). Post these definitions as a linked reference page so anyone can calibrate their assessments.
- Create a risk matrix visualization (4x4 grid) in Notion showing which probability-impact combinations are in the red, yellow, and green zones
- Set the formula property to multiply the numeric values: if Probability is 'High 3' and Impact is 'Very High 4', score = 12
Populate Initial Risks
Run a risk identification session with your project team where each person writes down three to five risks they foresee. Common risk categories to probe: technical risks (unproven technology, integration complexity, performance unknowns), resource risks (key person dependency, competing priorities, hiring delays), scope risks (unclear requirements, stakeholder disagreements, late-breaking changes), external risks (vendor delays, regulatory changes, market shifts), and schedule risks (dependency delays, testing bottlenecks, deployment risks).
- Score each risk for probability and impact during the session while the team can discuss and calibrate
- Assign an owner to every risk — unowned risks are unmanaged risks
Create Mitigation Plans for High-Score Risks
For every risk with a score of 6 or above (the red zone), write a specific mitigation plan. A mitigation plan should include: the strategy (avoid, reduce, transfer, or accept), the specific actions to reduce probability or impact, the resources needed, and the timeline. For example, if the risk is 'Key engineer leaves mid-project,' the mitigation might be 'Document architecture decisions weekly, pair-program on critical components, identify backup engineers by end of sprint 2.'
- For each mitigation plan, define a concrete trigger point — 'If X happens, we execute plan Y'
- Estimate the cost (time, money, opportunity) of each mitigation so the team can decide if it's worth the investment
Build Views for Different Audiences
Create filtered views that serve different needs. A 'High Priority Risks' board view filtered to scores above 6 and grouped by status gives the PM a quick danger assessment. A 'My Risks' filtered view by owner helps individuals track their assigned risks. A 'By Project' grouped view shows risk distribution across active projects. A 'Review Needed' view filters to risks not reviewed in the last 14 days to flag stale assessments.
- Create a 'Risk Heatmap' summary page that embeds the risk matrix with current risk counts in each cell
- Add a timeline view for risks with mitigation deadlines to spot scheduling conflicts
Establish a Review Cadence
Schedule bi-weekly risk reviews as part of your project status meeting. During each review: update scores based on new information, add newly identified risks, close risks that are no longer relevant, check mitigation plan progress, and review any risks that have materialized. The register is only valuable if it's current — stale risk assessments are worse than no assessments because they create false confidence.
- Add 'Risk Review' as a standing agenda item in your sprint retrospective or project status meeting
- Track risk trends over time — are risks being mitigated faster than new ones are identified?
Common mistakes
Identifying Risks Without Assigning Mitigation Owners
A risk without an owner is a risk nobody is managing. Every risk in the register should have a named person responsible for monitoring it and executing the mitigation plan if needed. Unowned risks accumulate in the register and create a false sense of preparedness.
Only Identifying Risks at Project Start
Risk identification shouldn't be a one-time kickoff exercise. New risks emerge throughout a project as you learn more about the technical landscape, stakeholder expectations shift, and external conditions change. Make risk identification a recurring activity at every sprint boundary.
Scoring All Risks as Medium-Medium
If every risk is scored as medium probability and medium impact, your scoring provides no differentiation and no basis for prioritization. Be honest about which risks are genuinely high-probability or high-impact — the purpose of scoring is to surface the most dangerous risks, not to make everything look equally manageable.
Tips
Use Notion's database relation to link risks to specific project milestones — this shows which milestones are at risk and helps with contingency planning.
Create a 'Risk Occurred' template that captures the actual impact when a risk materializes, so the team can compare predicted vs. actual impact and improve future assessments.
Include positive risks (opportunities) in your register alongside threats — unexpected upside deserves the same structured thinking as potential downside.
Review closed risks from past projects before starting a new one — patterns in what went wrong reveal the types of risks your team consistently underestimates.
How Vantage helps
Vantage captures project context and risk factors during PRD generation. When risks are identified in your Notion register, you can reference them as context in Vantage to ensure that the PRD addresses known risk areas in its requirements and the generated tickets include mitigation tasks alongside feature work.